Privacy Policy

Last updated: 2 September 2026

This policy explains what happens to the information you give us, in plain terms. It covers the payment assessment form, the rest of payhighrisk.com, and any email exchange that follows.

Who is responsible for your data

PayHighRisk is the trading name of Ecom-Rach, LLC, a limited liability company registered in the State of South Carolina, United States, which publishes payhighrisk.com and is the data controller. Registered address: 809 Silvercrest Dr, Myrtle Beach, SC 29579, United States.

For anything relating to this policy or to your personal data, write to privacy@payhighrisk.com. We answer within one month, as the GDPR requires.

What we do, and what we do not do

PayHighRisk assesses a merchant’s business model, jurisdiction, risk profile and processing requirements, then identifies which payment partners could realistically consider the file. That is the whole of our role.

We are not a payment gateway, a payment service provider, an acquirer or a merchant account provider. We never hold, receive or move your money or your customers’ money. We do not collect, examine or verify identity documents, bank statements or licences, and we do not decide whether you are accepted. Those steps belong to the payment partner, who deals with you directly.

What we collect, and why

When you submit the payment assessment

The form asks for information about your business and your payment history: company name, your name, business email, phone number, website, country of incorporation, industry, how long you have been trading, how you sell, your expected monthly volume, settlement currency, average transaction value, the payment methods you need, your current or most recent processor, whether an account has been declined or closed and why, your chargeback rate, how much processing history you can evidence, a description of what you sell, any licences you hold, your timeline, and anything else you choose to tell us.

The form has no file upload, deliberately. We ask what evidence you could provide; we never ask you to send it. Documents go to the payment partner, not to us.

We use your answers for one purpose: to assess whether we can introduce you to a payment partner who underwrites your sector, and to prepare that introduction. Nothing more.

Automatically, when you submit

We also record the date and time of your submission, the page you submitted from, any campaign parameters in the link you arrived through, your browser’s user agent, and a one-way cryptographic hash of your IP address. We do not store the IP address itself. The hash lets us spot repeat or automated submissions; it cannot be turned back into an address.

We keep a record of the moment you ticked the consent box, because we have to be able to show that you did.

If you bought a plugin licence in the past

We no longer sell the WooCommerce plugins. Records of past orders — billing details and email — remain in WooCommerce for as long as accounting and tax rules require, and for nothing else. Payment card data was handled by the payment provider and never reached our servers.

The legal basis

• Your consent for the assessment form, including the transfer to a payment partner outside the European Union. You give it by ticking the box, and you can withdraw it at any time.
• A legal obligation to keep accounting records of past plugin orders, for as long as tax rules require.
• Our legitimate interest in keeping the site secure and free of automated abuse, which is what the hashed IP and user agent are for.
• A separate consent if you tick the optional box asking to hear about new payment options and services from PayHighRisk. It is optional in the real sense: leave it blank and your enquiry is assessed in exactly the same way. We record whether you ticked it and when, we use it for nothing else, and every message we send on that basis carries an unsubscribe link. Withdrawing it does not affect your enquiry.

Who we share it with

An assessment is only useful if a payment partner sees it. When your profile fits what a partner underwrites, we send them a summary of your business drawn from your answers, so they can confirm whether the opportunity is one they can work with. If it is, they take over directly with you, under their own privacy policy.

Some of our partners are established outside the European Economic Area, including in the United Arab Emirates. Those countries have not been recognised by the European Commission as offering an equivalent level of data protection. The transfer therefore rests on your explicit consent, given when you submit the form, in accordance with Article 49(1)(a) of the GDPR. If you would rather not have your details transferred outside the EEA, do not submit the form — write to us instead and we will tell you whether any EEA-based route exists for your profile.

We never sell your data, and we do not share it with anyone other than a payment partner reviewing your enquiry, our hosting provider, our email provider and our analytics provider.

Where it is stored

The website and its database are hosted in France. Email is processed by our mail provider. Both act as processors on our instructions.

Because the controller is established in the United States, your data is also accessible from there. The United States has not been recognised by the European Commission as offering an equivalent level of protection in all circumstances, and this access rests on the same explicit consent as the transfer described above.

How long we keep it

• Enquiries we do not refer to a partner: three years from your submission, then deleted. High-risk merchants often come back after a change of circumstances, and it saves you filling the form again.
• Enquiries we do refer: for as long as the resulting commercial relationship lasts, plus three years. Our partner agreements require us to be able to evidence when and by whom an introduction was made, and that evidence includes the enquiry itself.
• Past order records: as long as accounting and tax rules require. No new orders are taken.

Your rights

If you are in the European Union or the United Kingdom, you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything inaccurate;
• delete it;
• restrict how we use it, or object to a particular use;
• send it to you, or to someone else, in a portable format;
• withdraw a consent you previously gave, which does not affect anything we did lawfully before you withdrew it.

Write to privacy@payhighrisk.com. We may ask you to confirm your identity first, so that we do not hand your data to someone else.

One limit worth stating plainly: once we have passed your details to a payment partner and they are reviewing your file, they become responsible for their own copy. We will pass on your request and tell you who to contact, but we cannot delete data from their systems.

You also have the right to complain to a data protection supervisory authority in the country where you live or work.

Cookies and analytics

The site sets cookies that are necessary for it to work: session cookies, your shopping basket, and cookies set by our caching layer. These do not identify you and do not require consent.

We also use Google Analytics to understand how the site is found and used — which pages people read, which searches bring them, where they leave. It sets cookies and processes data on Google’s infrastructure, which includes servers outside the European Economic Area. You can prevent it entirely with Google’s opt-out browser add-on, or by refusing analytics cookies where we ask.

We do not currently run advertising or remarketing pixels. If that changes, this page will be updated first, and you will be asked for consent before any such cookie is set.

How decisions are made

We use a set of written rules to pre-sort enquiries: which partners state that they do not work with a given sector, and which routes make commercial sense at a given size. The result is a suggestion, recorded with the reason and the version of the rule that produced it.

It is never a decision about you. A person reads every assessment and decides whether to refer it, and no introduction is made automatically. Whether you are ultimately accepted is decided by the payment partner, under their own criteria, and not by us. Nothing on this site constitutes an approval, a pre-approval or a promise of one.

Children

This is a business-to-business service and is not directed at anyone under 18. We do not knowingly collect data about minors.

Changes to this policy

If we change how we handle your data, we will update this page and change the date at the top. Where a change is significant and we hold your contact details, we will tell you directly.